3

Didnt find any material of how to implement Cloudfront + MTLS or Api Gateway + MTLS. Is it possible? If not, is there any alternative to achieve MTLS with CloudFront + ApiGateway?

sashoalm
  • 75,001
  • 122
  • 434
  • 781
Carlos
  • 43
  • 1
  • 7

3 Answers3

3

The mTLS support for API Gateway was released yesterday. Here is a detailed blog post how to set it up:

https://aws.amazon.com/blogs/compute/introducing-mutual-tls-authentication-for-amazon-api-gateway/

am29d
  • 85
  • 5
3

In order to use mTLS you can't use CloudFront. This is because CF does the TLS Termination and doesn't support pass-through to APIGW or other downstream services.

If you wish to use mTLS, you should point your R53 domain name directly to API GW, disable the default endpoint, and add WAF to the API instead.

Enrico Bergamo
  • 163
  • 1
  • 14
0

mTLS is not supported for Edge-optimized APIs. You can use it with Regional APIs only

Ranbir Singh
  • 11
  • 1
  • 4
    Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Nov 18 '21 at 13:03